Can't follow the Getting Started guide

[michalborkowski96]

Hello.

I've been trying to follow the "Getting Started" guide here: https://goteleport.com/docs/server-access/getting-started/ on Amazon Linux 2.

1. After installation, teleport command isn't visible to sudo. I don't really have time to dig into this now, so I run the command specifying absolute path.
2. I cannot connect to the auth server.

I have, as in the example, two machines: A and B. On A I ran:

sudo /usr/local/bin/teleport configure   --acme [email protected]   --cluster-name=teleport.mydomain.com   -o file
sudo /usr/local/bin/teleport start

Then, in another shell:

sudo /usr/local/bin/tctl tokens add --type=node | grep -oP '(?<=token:\s).*' > token.file
sudo /usr/local/bin/teleport start   --roles=node   --token=./token.file   --auth-server=teleport.mydomain.com:443

And the teleport start command successfully spat out some INFO messages. Then I did the same teleport start command on machine B, but instead I got:

ERRO [PROC:1]    Node failed to establish connection to cluster: access denied, Post "https://teleport.cluster.local/v2/tokens/register": remote error: tls: internal error. service/connect.go:70

It's weird that Teleport uses teleport.cluster.local as a host. On machine A I saw in the terminal:

[PROXY:SER] ERRO "proxy2021/06/04 12:31:55 http: TLS handshake error from <some_address>:36202: acme can't get a cert for domain teleport.cluster.local, add it to the proxy_service.public_addr, or use one of the domains: teleport.mydomain.com\n" utils/cli.go:304

Which means that Teleport correctly resolves teleport.mydomain.com while connecting to the auth server, but insists on using teleport.cluster.local as host name.

What should I do now?

My goal is to have a simple SSH bastion.

[HighPriest]

Courtesy note:
It doesn't look too good when someone joins a community and immediately states "I don't really have time to dig into this now". If you don't have time to work on presented issues, please comeback later.

OnTopic:

sudo /usr/local/bin/tctl tokens add --type=node | grep -oP '(?<=token:\s).*' > token.file

Should be run on the auth server, where the authentication tokens are stored.
Then, also on auth server

sudo tctl nodes add --ttl=5m --roles=node --token=[GENERATED_TOKEN_HERE]

Now you can add both the token and ca-pin to configuration of the external Node and start the service there.
If you fail to add the external node within the 5m TTL, you'll have to do the tctl nodes add again.